Cyber Essentials v3.3 (April 2026): what changed and what it means for your clients
Version 3.3 of the Cyber Essentials requirements, published in April 2026, makes six changes. The one that matters most for clients is plain: cloud services cannot be left out of scope. None of the six alters the numbers in the five technical controls.
This piece lists each change as the document states it, then the standing rules every assessment still rests on. Everything quoted is from "Cyber Essentials: Requirements for IT Infrastructure v3.3", which you can find through the National Cyber Security Centre's Cyber Essentials pages. To see how one client measures up, there is Cyber Essentials readiness in Helios.
The six changes in v3.3
The document opens with a short "What's new in this version" list. These are its six items, in its order.
| What the document says is new | What it means for a client |
|---|---|
| Definition for "cloud services" provided | There is now one test for what counts. An account, and the client's data stored or processed. |
| Updated definition for passwordless authentication to include FIDO2 | Passkeys and security keys are named, and FIDO2 authenticators count as multi-factor authentication. |
| Definitive statement that cloud services cannot be excluded from scope | Microsoft 365, the accounts package and the CRM are all in the assessment. |
| Software Security Code of Practice introduced in the software development section | Clients who build software are pointed to it. Bespoke components stay out of scope. |
| Scope criteria no longer refers to "untrusted connections" | The three scope conditions now speak only of internet connections. |
| Importance of backing up data is emphasised | Backups are still not a requirement, but the document now "highly" recommends them. |
1. Cloud services are defined, and always in scope
The new definition reads: a cloud service is "an on-demand, scalable service, hosted on shared infrastructure, and accessible via the internet". For Cyber Essentials it is one that is "accessed via an account" and that will "store or process data for your organisation".
The account can be one the organisation issued, or simply "an email address used for business purposes". That catches services staff signed up to themselves.
The scope section then closes the door: "If your organisation's data or services are hosted on cloud services, these services must be in scope. Cloud services cannot be excluded from scope."
What to do for each client: list every cloud service that holds their data. Then check each one against the access rules, because the user access control section says "authentication to cloud services must always use MFA". A service that offers multi-factor authentication and has it switched off is a gap.
2. Passwordless authentication now names FIDO2
The definition now reads: "a method to establish a user's identity that uses a factor other than knowledge". The examples given are FIDO2 authenticators, biometric data, security keys or tokens, one-time codes, QR codes and push notifications.
Later the document adds that "FIDO2 authenticators are regarded as MFA because user authentication is performed". For a client moving to passkeys, that settles a question assessors used to be asked: a passkey sign-in meets the multi-factor rule by itself.
3. Scope no longer mentions "untrusted connections"
The requirements apply to devices and software in scope that meet any of three conditions. In v3.3 they read:
- "can accept incoming network connections from internet-connected devices"
- "can establish outbound connections to devices via the internet"
- "control the flow of data between any of the above devices and the internet"
In practice almost every computer a client uses meets the second condition. The document also keeps its blunt line: "A scope that doesn't include end-user devices isn't acceptable."
4. A pointer to the Software Security Code of Practice
This matters only to clients who write software. Commercial web applications are in scope by default. "Bespoke and custom components of web applications are out of scope." The document says the best protection there is sound development and testing, and now refers readers to the Software Security Code of Practice.
5. Backups are recommended more firmly
The wording is careful: "Backing up your data is not a technical requirement of Cyber Essentials. However, we highly recommend implementing an appropriate backup solution." Nobody fails for having no backup. It is still the first thing to raise with a client who has none.
The rules that have not changed
The new wording sits on top of the standing rules, and those are where the day-to-day work is. These are the numbers to know.
| Rule | The number |
|---|---|
| Security updates | Within 14 days of release, for vulnerabilities the vendor calls critical or high risk, with a CVSS v3 base score of 7 or above, or with no stated severity |
| Wrong guesses before a device locks | No more than 10, or throttling to no more than 10 guesses in 5 minutes |
| A PIN or password used only to unlock a device | At least 6 characters |
| Passwords for accounts | Multi-factor authentication, or at least 12 characters, or at least 8 characters with a deny list of common passwords |
| The password used alongside multi-factor authentication | At least 8 characters, with no maximum length |
| Cloud services | Must always use multi-factor authentication |
Two points in that table are often misread. The document does not ask for regular password expiry or for complexity rules. It lists "not enforcing regular password expiry" and "not enforcing password complexity requirements" among the ways to support users.
One thing that is not in the requirements: a screen-lock timeout. Many checklists ask for the screen to lock after a set number of minutes. Version 3.3 asks that a credential is in place before anyone can use a device, and that guessing is limited. It sets no idle timer. Locking the screen is good practice, but it is not a Cyber Essentials rule.
What to do for your clients now
- List each client's cloud services and check multi-factor authentication on every one.
- Ask the Certification Body which version a client's next assessment will be marked against. We could not confirm a cut-over date from the requirements document itself.
- Check the 14-day rule against real dates, on every machine, including third-party applications.
- Raise backups with any client who has none, even though no answer depends on it.
- Read the machines against the settings rules. Our Windows checklist with PowerShell gives the command for each.
For the whole job in order, see Cyber Essentials for MSPs, control by control.
Where this fits with Helios
Helios checks every Windows machine each day against the technical controls, including the 14-day update rule and the lockout count. Most failing settings have a one-press fix. Where Microsoft 365 is connected, it shows how many people have multi-factor authentication set up, next to the question it answers.
It is a readiness check, not a certificate. Only a Certification Body awards Cyber Essentials, and the assessment also covers routers, phones and cloud services. More detail is on the Cyber Essentials readiness in Helios page.
Questions people ask
What changed in Cyber Essentials v3.3?
Six things: a definition of cloud services, FIDO2 added to the definition of passwordless authentication, a statement that cloud services cannot be excluded from scope, a reference to the Software Security Code of Practice, the removal of "untrusted connections" from the scope criteria, and stronger emphasis on backing up data.
Can cloud services be left out of a Cyber Essentials scope?
No. Version 3.3 says cloud services that host an organisation's data or services must be in scope and cannot be excluded.
Does Cyber Essentials require a screen lock after a set time?
No. The requirements ask for a credential before a device can be used and a limit on wrong guesses. They do not set an idle timeout.
Does Cyber Essentials require backups?
No. The document says backing up data is not a technical requirement, and highly recommends it.
Read next
Why MSPs choose Helios
One platform that does the work, at a price that stays put
Helio fixes, not just flags
When an alert fires, Helio, the AI technician built into Helios, investigates it, writes the fix and runs it once you approve. It keeps what works, so the next one is quicker.
Everything in one product
RMM, a service desk with SLAs, patching including third-party apps, remote access, Microsoft 365 and Defender checks, backup monitoring, a client portal and billing into Xero or QuickBooks.
Priced by fleet, not by people
£4 a device on Launch up to 25 devices, from £20 a month, then £99, £199 or £399 a month by fleet size, with any number of technicians and every feature on every plan.
A price that stays put
Your price is locked for as long as you stay subscribed, and that is written into our terms. Monthly billing, cancel any time.
Bring your clients across
Import your clients and machines from another RMM's CSV export, then roll the Helios agent out at your own pace, with a count of how many have arrived.
14 days free, no card to start
The full platform from the first minute, on your own machines. No sales call. Remote control asks for one card check, and nothing is charged.
See how ready your own machines are
Helios checks every Windows machine against the Cyber Essentials technical controls each day, fixes most of the settings in one press and gives you a readiness report under your own name. It is part of the platform on every plan. 14-day free trial, no card to start, set up in minutes.
Start free